Business continuity

The email is down, staff cannot access the business system, or suspicious encryption takes over shared documents. This is when business continuity is tested – not by whether there is a long document in a folder, but by whether people can continue to serve customers, process orders, and access the data that matters.

For most small and medium-sized businesses, a business interruption is not just a technical problem. It quickly becomes a loss of revenue, customer dissatisfaction, increased workload for staff, and a risk to the company's reputation. Good business continuity is therefore about making the right priorities in advance, protecting the systems that keep the business running, and knowing exactly what to do when something goes wrong.

What does business continuity involve?

Business continuity is a company's ability to keep its most important operations running, or to restart them quickly, when a disruption occurs. The disruption could be a cyber-attack, a server failure, a power outage, a user error, a damaged laptop, a cloud service outage, or the illness of a key employee.

This is broader than data backup. A backup can save a file, but it doesn't automatically say who decides to restore data, how employees work in the meantime, which systems should be fixed first, or how customers are informed. Business continuity connects technology, processes, responsibilities, and communication.

The goal is not to eliminate all risk. That is neither realistic nor cost-effective. The goal is to reduce the likelihood of a serious disruption and limit its impact when it occurs. A company needs to be able to answer a simple question: How long can we be without this system before the business suffers unacceptable damage?

Start with the business, not the technology

Common mistakes include starting by buying a new security system or more storage space for backups. These tools may be necessary, but they don't solve the problem if it's unclear which business processes they are meant to protect.

Instead, start by mapping out what the company needs to operate the next business day. For a service company, this might include email, phone, customer management system, and access to contracts. For a distribution or manufacturing company, inventory systems, orders, labelling, and supplier connections might be priorities. For companies working with sensitive data, secure access, correct access controls, and traceability are particularly important.

When this is in place, systems must be classified by importance. Some systems can be down for a day without major consequences. Others cannot be inaccessible for an hour. This distinction helps managers prioritise the cost of protection sensibly, rather than trying to build the same protection around everything.

Two criteria that change the discussion

Two criteria are particularly useful. Recovery Time Objective (RTO) indicates how quickly a system needs to be back in operation. Recovery Point Objective (RPO) indicates how much data loss the company can tolerate. If an accounting system cannot afford to lose more than an hour of entries, the backup and recovery method must take this into account. If an internal document archive can tolerate losing changes from the last day, the solution can be simpler and cheaper.

These are business decisions, not purely technical concepts. They determine where investment yields the most and where the company consciously chooses to take risks.

Backups are only useful if they can be restored

Many companies believe they are well protected because backups run every night. But a backup that has not been tested is a hope, not a plan. Files may be incomplete, access to backups may prove unclear, or recovery may take much longer than the operation can tolerate.

A robust backup strategy keeps more than one copy of important data, separates backups from the daily work environment, and protects them against unauthorised changes. This is especially important against ransomware, which often tries to delete or encrypt backups before demanding payment.

Testing is equally important. The entire company does not need to be shut down each time, but selected files, mailboxes, virtual machines, or key systems must be regularly restored in a controlled environment. This reveals whether the backups work, whether the procedure is clear, and whether the recovery time meets the operation's requirements.

It is also important to understand the difference between backup and synchronisation. Synchronised cloud storage makes documents accessible on multiple devices, but it can also synchronise errors, deletions, and encrypted files. Therefore, it does not replace a dedicated backup with retention of older versions.

Security and operational continuity are the same task

Cybersecurity is often discussed as defence, while operational continuity is discussed as a response plan. In reality, these areas are closely related. The better the company's defence, the lower the likelihood of disruption. The clearer the response, the smaller the damage if the defence fails.

Many serious disruptions start with a simple vulnerability: a leaked password, an unpatched computer, a user opening a malicious attachment, or overly broad access to shared data. Multi-factor authentication, central device management, update control, endpoint protection, and good password management significantly reduce this risk.

However, it must be assumed that something will get through. It must then be clear who can isolate devices, who contacts service providers, how evidence is preserved, and how staff receive instructions. A hasty decision can increase damage, for example, if a critical device is restarted before the attack can be analysed, or if an employee tries to delete traces themselves.

Clear responsibility saves valuable time

In the event of a serious failure, uncertainty is costly. Staff do not need to read a long manual to know what to do first. They need a short, accessible procedure with clear responsible parties and the correct communication channels outside of the systems that may be down.

The plan should, among other things, define who takes control of the response, who assesses the technical situation, who contacts key suppliers, and who is responsible for communication with staff and customers. It must also specify when senior management, the insurance company, legal counsel, or a regulatory authority becomes involved. The exact implementation depends on the size of the company and the nature of the data it processes.

Access is key in this context. If one employee alone manages domains, backups, cloud environments, or passwords, operational risk arises, even if that person is trustworthy and competent. The company needs to own the access, manage it in a controlled manner, and ensure that the right people can act when needed.

Test the plan before it needs to work

A business continuity plan that has never been tested often becomes too complex, outdated, or unrealistic. A simple tabletop exercise can achieve a lot. Managers and key staff sit down and work through a realistic scenario: The business system is inaccessible at nine o'clock on a Monday morning. What do we do in the first 15 minutes? How do we receive orders? What data do we need? Who talks to whom?

Such exercises uncover gaps that a technical checklist doesn't always spot. Perhaps a supplier's phone number is only stored in an inaccessible mailbox. Perhaps no one can approve extra costs for an emergency repair. Perhaps the workflow depends on a single employee who is on holiday. These are problems that can be fixed before they become expensive.

The plan also needs to evolve with the company. A new accounting system, more remote workers, an acquisition, a move to the cloud, or new data protection requirements change the risk profile. An annual review is a good minimum rule, but changes to key systems should always trigger a reassessment.

The right scope is better than a complex solution

Not every company needs to build two data centres or buy the same solutions as a global corporation. Too much complexity can actually create new risks, increase costs, and slow down response times. However, the cheapest solution can become expensive if it leaves critical data unprotected or makes recovery impossible within an acceptable timeframe.

The right path lies in the right scope. A company with few devices and a simple cloud environment needs clear access control, secure backups, active protection, and responsible support. A company with a distributed workforce, specialised operating systems, and strict data requirements generally needs more in-depth monitoring, documented processes, and regular testing.

At nexIT, we approach this as an operational task, not a collection of unrelated devices. We help companies identify weaknesses, manage their daily IT environment, improve protection, and prepare for recovery so that costs and risks are proportionate to the business.

The next sensible step is not necessarily to rewrite all procedures at once. Choose one critical system, ask how long the company can afford to be without it, and then verify that people, access, backups, and responses meet that requirement. That's where real operational security begins.